Tales from the Techside

Exploit Ebay

A couple of weeks ago I wrote about the WMF Exploit that affected users of Microsoft Windows and would allow for mal-ware to be installed by simply viewing a malicious picture file. E-Week this morning has uncovered a story that this exploit was selling on via the "underground" a full two weeks prior to the exploit being publicly noticed. The exploit first uncovered by people who produce malicious code was up for auction a couple of weeks before anti-virus vendors were aware there was a problem.

For $4000 a spy-ware distributor could buy the exploit code and then have the perfect vehicle to distribute his or her wares. According to the article the exploit was first purchased in early December and days later it was on the web infecting random machines. Luckily the people who discovered the vulnerability were unaware of its full potential and thus only the exploit code was up for sale. If they had taken the time to develop a proof of concept this could have been much worse. As it was according to the eWeek article the lead time that the spy-ware distributor who purchased this exploit code enabled him or her to infect thousands of computers with over a 1000 exploited image files found online.

What is most chilling about this article is that it confirms a growing concern among security professionals that exploits are going up on the auction block. While this is nothing new; underground websites and IRC have long been places where script kiddies and others could get exploit code. However the organization is beginning to develop. There is big money in spy-ware and mal-ware and as such other secondary support channels are beginning to arise. I would not be surprised if in the next couple of years there will be a virtual exploit eBay with both exploit code and proof of concept code on the auction block.

 

Researcher: WMF Exploit Sold Underground for $4,000

Ouch so harsh the criticism ~ though justified

Sandi Hardmeier over at the spywaresucks blog who I have an immense amount of respect for has some pretty harsh words of criticism regarding the blog worm which is spreading via social networking across the internet. I agree with her conclusions that while Robin Schuil may have nothing but the best intentions in posting the blog worm it is irresponsible for people to trust Robin carte blanche. Say for instance Robin replaces the innocuous file with something that is way worse say a WMF file. Now take that a step further what if Robin's site got hacked and the picture were replaced without his knowledge. Or someone saw the distribution potential and attempted to capture the same effect except for malicious purposes. It is all simply a matter of trust just because something seems innocent doesn't mean it is, just think of the Greek's and the Trojan horse if you need a clearer example.

Just to clarify though Robin I think it is a cute idea I would however recommend that you provide a download link for people to host your image. The blog worm can still spread but it should be tamed.

Spyware Sucks : Today's "You're an IDIOT" award goes to...

Clean that old cell phone before selling it or giving it away

A couple of days ago I received an email from a friend who wanted to sell her old phone to trade up to a new cooler model and that got me thinking what about all the information she has her cell phone? Is she going to go through and delete all her contacts and information before selling her cell phone, knowing her, the answer is yes but I am sure other people aren’t so diligent.

That got me thinking even further, cell phones have become the de facto personal information managers for people and with the rise in newer smart phones that trend is sure to continue. If you use a cell phone you know what I am talking about getting all the information off your old cell phone is often a daunting task requiring patience, steady hands, and a whole weekend if done manually. But what if you want to delete said information there isn’t to my knowledge any button or procedure that is universal to delete the data from your cell phone so how do people remove that info. The simple truth is they probably don’t, with the continuing fall in cell phone prices they have become a disposable item. When they are done they toss it out with trash or give it away but rarely do people give a thought to the information stored on their old cell phone.

Stories abound on the internet about people who have traded in their old cell phones for refurbished ones and received cell phones replete with phone numbers, emails, contacts, passwords, and even pin numbers. Do people really take the time to figure out how to remove all call logs, clear the address books, contacts, emails, and personal data stores from their cell phone? No, and with good reason it is not well documented. Luckily there is hope if you go to http://www.wirelessrecycling.com/ they have a intuitive application designed to walk you through this process.

For example I have a Motorola T193 entering my manufacturer name and model of my cell phone I see that to erase all my data from my cell phone I need to do the following:

Master Reset:

1) Press MENU

2) Press down to Settings, press OK

3) Press (Phone Setup) OK

4) Press up to Phone Status, press OK

5) Press down to Master Reset, press OK

6) Enter 6 digit security code (default is 000000)

Master Cear:

1) Press MENU

2) Press down to Settings, press OK

3) Press (Phone Setup) OK

4) Press up to Phone Status, press OK

5) Press down to Master Reset, press OK

6) Enter 6 digit security code (default is 000000)

 

So if you are getting rid of your old cell phone do yourself a favor and visit http://www.wirelessrecycling.com/ and use their tool to ensure that your data is cleared out.

Cell Phone Eraser Direct Link: http://www.wirelessrecycling.com/home/data_eraser/default.asp

 

Next Version of Windows SANS Anti-Virus

For the past year plus industry experts have gone back and forth arguing the likelihood and merits of an integrated ant-virus service with the latest version of Windows codenamed Vista. Today in an interview with Microsoft's Jim Allchin the co president of the platform development division put the rumors to bed with a clear to the point answer:

CRN: Is there going to be antivirus in Vista?

Allchin: No, there is not.

CRN: Why?

Allchin: It's a complicated answer as to why not.

CRN:  Was the decision based on technical concerns?

Allchin: It wasn't technical.

Well that's all folks no antivirus for Windows Vista. Now some will be happy some will be sad, I personally think an integrated anti-virus solution would have been a great security move for Microsoft but a poor business strategy. If they learned anything from their Internet Explorer antitrust, and MSN messenger client cases it is that while an all in one solution is good for the consumer it is anti-competition.

With companies scrabbling to sue for rights infringement it is likely that Microsoft wants to shield themselves from unnecessary exposure and I say good on them. Though with the quality of the recent security initiatives from Microsoft (safety.live.com, Microsoft anti-spyware, and other strategic acquisitions) I feel bad for the consumers. I am sure though that they will have the opportunity to purchase the MS anti-virus application through the integrated shopping cart, unless of course they remove that as well.

Allchin interview with CRN

Be Careful When Loading a Play List in Winamp

While cruising on the Security Focus website I saw among the various exploits for windows and microsoft office one I didn't really expect to see from WinAmp. WinAmp a popular media platform on Windows for its ability to load and stream custom playlists is vulnerable to a malformed playlist exploit which could cause the target computer to slow to a crawl in most cases and even blue screen in others. The vulnerability occurs when winamp attempts load a playlist that is of an extreemly long filname or large byte size while processing the playlist it gradually consumes more and more resources until the target computer crashes.

This vulnerability has been confirmed in the latest version of Winamp and the author of the vulenerability surmises that it could be an issue with earlier ones as well. Best bet don't load playlists from people you don't know and trust. Ultimately this article is just another example of the list of third party application exploits available. As windows PC's become more locked down exploit authors and script kiddies are turning more and more to third party applications to wreak havoc on systems. Therefore it becomes incumbant on the consumer to make it a weekly habit to audit software on their pc and remove those applications they don't need. Most of the larger third party software adobe, macromedia, etc.. come with update clients run them on a regular basis to make sure you are protected from exploits. Finally read and stay on top of security as a computer user now days you are user, and administrator, and your own personal security expert.

SecurityFocus

Trojan Writers Taking Aim for the BIOS

    For those of you who don't know the BIOS is the Basic Input/Output system or the set of instructions that a computer runs at startup the BIOS configures the peripheral devices (hard drives, keyboard, mouse, etc..) connected to a system and then loads the operating system. The BIOS due to its fundamental function is protected from the system image by being stored on a ROM chip (persistent memory) separate from the operating system.  What the security researchers have surmised is that it may be possible using a set of procedures called the ACPI or the advanced configuration and power interface to insert code in the BIOS that could resurrect a Trojan or other piece of malware after the system has been restored to a clean image paving the way for truly persistent Trojans.

    Root kits have recently made a big name for themselves with the Sony XCP debacle but they are not a new problem. Root kits have been around since the earliest days of hacking and in fact many of the technologies that allow for remote control of computer systems over the internet are based on root kit technologies. Not to say they are root kits just that there are legitimate uses for the technology. At the same time there has been several attempts to launch a pervasive infection with some level of effectiveness but due to diversity of the chipsets and programming interfaces it is hard to target an infection to affect a large array of computers. Now with the inception of ACPI (which by the way is not a new thing) researchers feel that root kit creators may have the tools they need to make this not only feasible but eminent.

    My own read of this is that there are too many variables out there to allow for large scale infection of the sort they predict, there are so many BIOS types and versions each with its own tables and interface points that it would make it a huge investment in resources to create a large scale attack of this type. Factor in that in some not all motherboards you have to move a jumper to write to the memory area where the BIOS is stored and this becomes even more likely and the limited storage capacity of a BIOS ROM chip will make it necessary to store some files on the harddrive. So this becomes a scenario more likely associated with one individual seeking to gain on another individual or organization. To be effective though the attacker would need to gather information on the BIOS the version number and then have physical access if there was a jumper to be moved and also a method of delivery. So to protect from this threat I recommend the following:

1. Make sure your board is protected from BIOS flashing by requiring a jumper to be moved
2. Disable the verbose messages at startup that display the BIOS type and version
3. Password protect your BIOS access
4. Employ physical safeguards such as a key and lock for the case to ensure physical access is limited to a trusted few
5. If you feel you have been compromised isolate that system and re-flash the BIOS which will erase the information currently stored and replace it with a known good version you currently posses.

    While I don't honestly believe that this calls for a large scale panic it is definitely something the CIO’s and those trusted with the information security of an organization should consider. At the very least employing physical safeguards such as lock and key to the case will eliminate the threat for those systems that require a jumper move and also limit the possibility of theft of peripheral systems such as extra hard drives and video cards. I do foresee however a new business model in the way of BIOS guards and BIOS scanners and ACPI interceptors.

Researchers: Root kits headed for BIOS

 

Embedded Web Fonts Could Allow Remote Code Execution

An attacker who successfully exploited this vulnerability could take control of an affected system. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Affected Software:

	Microsoft Windows 2000 Service Pack 4 – Download the update
	Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2 – Download the update
	Microsoft Windows XP Professional x64 Edition – Download the update
	Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1 – Download the update
	Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems – Download the update
	Microsoft Windows Server 2003 x64 Edition – Download the update
	Microsoft Windows 98, Microsoft Windows 98 Second Edition (SE), and Microsoft Windows Millennium Edition (ME) – Review the FAQ section of this bulletin for details about these operating systems.

WMF Vulnerability Patch Posted

Microsoft got the patch out for the recent WMF exploit that was causing everyone in the security world so many headaches. If your a Windows user do yourself a favor and get the patch as soon as possible.

http://www.microsoft.com/technet/security/Bulletin/ms06-001.mspx

SANS Explains what this WMF stuff is all about

For those of you who are curious or confused as to how the WMF exploit or the unooficial patch works and why SANs has put together a pretty cool presenation that breaks it down Barney Style.

SAN's presentation in pdf (Portable Document Format - Adobe)
SAN's presentation in ppt (Power Point)

Link: http://isc.sans.org/diary.php?date=2006-01-03

WMF Exploit Patch From Microsoft Coming Soon

From Security Now Show Notes:

It would seem that we can be pretty certain that Microsoft will have this WMF vulnerability mess cleaned up shortly. Microsoft's cryptographically signed and authentic (though perhaps not final), security update addressing this vulnerability has prematurely leaked onto the Internet.

As expected, Ilfak's WMF vulnerability suppression patch, and his WMF vulnerability testing utility, both interact smoothly and seamlessly with Microsoft's forthcoming official security update. Ilfak's code can be left running while installing Microsoft's security update, then safely removed forever once the system has rebooted from the update.

Also, Ilfak's vulnerability tester properly recognizes the system's true WMF vulnerability condition under every combination of patch installations (either Ilfak's, Microsoft's, both, or neither). So, you may use Ilfak's solutions with confidence while Microsoft completes their extensive compatibility and regression testing for this forthcoming security update. Once the update is ready, install Microsoft's update, then safely remove Ilfak's patcher.

Note: The updated GDI32.DLL file contained in this patch, was built in the evening of December 28th, LAST WEDNESDAY. It is clear that Microsoft jumped on this problem — and had it resolved — almost immediately. But the nature of the installed base of Windows systems, and Microsoft's understandable need to be absolutely certain they don't break anything else with this new replacement GDI32.DLL, requires that they take the time to thoroughly test anything they change.

From GRC: http://www.grc.com/sn/notes-020.htm